CIT Accomplishments and Plans - Computing at Cornell - Cornell ...

17
Data Discovery Tools
To support both the campus-wide
data discovery effort and CIT IT Security
incident response and analysis,
Spider 2008 and IdentityFinder have
been made available to the campus
community .
Spider 2008 is a fundamental
redesign of Spider software we’ve
had for years . In contrast to previous
versions, which were built around an
IT-directed scan model, Spider is a
self-service system . End-users should
be able to scan their own machines
and take whatever remedial actions are
appropriate .
The redesign of Spider is an
outgrowth of interest from Cornell
and other Spider user sites to develop
something usable by a casual person,
with minimal IT support . Featurewise,
Spider 2008 is complete . Several
universities have expressed an interest
in centralized reporting, though . For
more information, see
cit.cornell.edu/services/spider/ .
In addition to updating Spider for
end-user availability, we licensed
approximately 10,000 copies of
IdentityFinder for both PC and Mac .
With powerful centralized reporting,
excellent Outlook integration, and
easy deployment, IdentityFinder
significantly augments our data
discovery and incident response
capabilities . For more information, see
cit.cornell.edu/services/idfinder/ .
Enhancements to Campus
Incident Response Program
Previously, when a system was
compromised, IT Security was required
to capture an image of the entire drive,
run Spider on that image, search for
signs of malware, and then laboriously
go through a process to gauge risk of
data loss . This process could disrupt a
department’s work, because it would
often keep a machine out of service
for several days . Additionally, modern
varieties of malware are significantly
smarter and more flexible than when
our procedures were developed .
When a system that may hold
confidential data is compromised,
we’re obligated to analyze the affected
system to help inform DIRT (Data Loss
Incident Response Team), a group
representing various campus offices
that decides what action the university
should take in the event of a data
breach . An ongoing project within IT
Security is to develop a new process
that should allow us to gather more
data, faster, while minimizing our
impact on department operations . This
new process also means we quickly get
an accurate, informative alert to DIRT .
“Flush the Phish” awareness materials remind students to keep their NetIDs private .
Easier Password Management
The password complexity
requirement was first implemented in
2005 . Since then, Cornell’s alumni and
trustee community have been brought
on board with the use of NetIDs to
access Cornell services .
Feedback provided from those
customers and the offices serving them
demonstrates that coming up with a
password that meets the requirements
can be challenging and even
frustrating . We began looking at ways
to ease this task without sacrificing the
added security of complex passwords .
The changes made involved giving
the user immediate feedback as they
enter the characters that make up the
password . Users can tell at any time
during the process which requirements
they have yet to meet . Previously they
would have to submit the proposed
password before they received a “pass/
fail” report .
We also modified the restriction on
dictionary words to make the use of
passphrases possible . Some people find
creating a password that is associated
with a phrase (a passphrase) easier to
remember . By virtue of its length, a
passphrase is stronger than a password .
If the dictionary word is less than five
characters or makes up less than forty
percent of the passphrase, it will be
accepted .
The use of complex passwords is
an integral part of keeping university
data and individual identities safe .
Simplifying their use will add strong
support for this security practice .